Digital watermark adversarial sample generation method, computer equipment and storage medium

Abstract

The invention relates to a digital watermark adversarial sample generation method, computer equipment and a storage medium, and the method comprises the steps: obtaining an original image; respectively constructing a disturbance optimization model in a white box scene and a boundary approximation model in a black box scene according to the original image and the target watermark detectors in different scenes; iteratively updating through the disturbance optimization model and the boundary approximation model to obtain target disturbance in a corresponding scene; the target disturbance can be detected by the target watermark detector, and the interference on the original image is minimum; and generating a target confrontation sample according to the target disturbance. According to the method and the device, the target disturbance which can pass the detection of the target watermark detector and has minimum interference on the original image can be obtained through the corresponding models in different scenes, and the efficient and hidden target adversarial sample generation for different scenes is realized.

Description

Technical Field

[0001] The present application relates to the field of digital watermark technology, and in particular to a method for generating digital watermark adversarial samples, a computer device, and a storage medium. Background Art

[0002] Digital watermarking technology is a method of embedding specific information in digital content (such as multimedia, documents, software, etc.). This information is usually invisible or difficult to detect, but can be detected by specific systems or algorithms. Therefore, it can be used in copyright protection, anti-counterfeiting and traceability.

[0003] In order to improve the security and robustness of digital watermarks, for different scenarios, security verification can be performed through simulated attacks, and the performance of watermark detectors can be evaluated. The current adversarial samples cannot meet these requirements, so it is necessary to generate an effective and hidden adversarial sample. Summary of the invention

[0004] Based on this, it is necessary to provide a digital watermark adversarial sample generation method, computer device and storage medium that can generate effective and concealed adversarial samples to address the above technical problems.

[0005] In a first aspect, a method for generating a digital watermark adversarial sample is provided in this embodiment, including:

[0006] Get the original image;

[0007] According to the original image and the target watermark detectors in different scenarios, a perturbation optimization model in a white box scenario and a boundary approximation model in a black box scenario are respectively constructed;

[0008] By using the disturbance optimization model and the boundary approximation model, iterative updating is performed to obtain a target disturbance in a corresponding scene; the target disturbance can be detected by the target watermark detector and has minimal interference to the original image;

[0009] According to the target perturbation, a target adversarial sample is generated.

[0010] In some of the embodiments, constructing a perturbation optimization model in a white-box scenario according to the original image and the target watermark detector in different scenarios includes:

[0011] Acquire an image to be processed; the image to be processed is the original image after the first initial disturbance;

[0012] In the disturbance optimization model, minimizing disturbance is taken as the optimization goal, and the bit-by-bit accuracy between the decoded image to be processed and the original watermark in the original image, and the first threshold of the first target watermark detector constitute constraints.

[0013] In some of the embodiments, the disturbance optimization model is:

[0014]

[0015] st|R(D(I w +δ),w)-E|≤∈

[0016] Where δ represents disturbance; w represents the original watermark; E represents the preset threshold; I w Represents the original image; (I w +δ) represents the image to be processed; D represents the decoder; R(D(I w +δ),w) represents the bit-by-bit accuracy between the decoded image to be processed and the original watermark; ∈ is a small value; ‖‖ ∞ Represents the infinite norm.

[0017] In some embodiments, the iterative updating of the disturbance optimization model to obtain the target disturbance in the corresponding scenario includes:

[0018] By adaptively optimizing the disturbance boundary, iteratively updating based on the first initial disturbance until the current disturbance meets the first preset condition or the number of iterations reaches an upper limit, a first target disturbance is obtained.

[0019] In some of the embodiments, the iterative update process further includes:

[0020] By performing a projection operation on the current disturbance, a norm of the current disturbance is made within the disturbance boundary;

[0021] and / or, updating a momentum accumulator according to a current gradient, so as to update the current disturbance via the momentum accumulator;

[0022] And / or, updating the current disturbance according to the direction of the current gradient.

[0023] In some of the embodiments, constructing a boundary approximation model in a black box scenario according to the original image and the target watermark detector in different scenarios includes:

[0024] By training the classification layer structure, a second target watermark detector is obtained; the second target watermark detector is used to output a classification result of whether the current disturbance passes the detection;

[0025] In the boundary approximation model, the decision boundary of the classification layer is approximated continuously and iteratively.

[0026] In some of the embodiments, it also includes:

[0027] The original image is subjected to adaptive median filtering and compression initialization in advance to determine a second initial disturbance that can be detected by the second target watermark detector.

[0028] In some of the embodiments, the step of iteratively updating the boundary approximation model to obtain the target disturbance in the corresponding scenario includes:

[0029] According to the classification result, the current disturbance is dynamically adjusted on the basis of the second initial disturbance until the current disturbance satisfies a second preset condition or the number of iterations reaches an upper limit, thereby obtaining a second target disturbance.

[0030] In some of the embodiments, the iterative update process further includes:

[0031] Dynamically adjusting the perturbation step size according to the decision boundary and the current perturbation;

[0032] and / or, performing a projection operation on the current disturbance so that the norm of the current disturbance is within the disturbance boundary;

[0033] and / or, determining a disturbance boundary of the current disturbance by binary search;

[0034] And / or, recording the query times of the second target watermark detector, and terminating the iteration when the query times reaches an upper limit.

[0035] In a second aspect, a computer device is provided in this embodiment, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for generating digital watermark adversarial samples described in the first aspect is implemented.

[0036] In a third aspect, a storage medium is provided in this embodiment, on which a computer program is stored, and when the program is executed by a processor, the method for generating digital watermark adversarial samples described in the first aspect is implemented.

[0037] Compared with the related art, the digital watermark adversarial sample generation method, computer device and storage medium provided in this embodiment obtain the original image; according to the original image and the target watermark detector in different scenes, respectively construct the perturbation optimization model in the white box scene and the boundary approximation model in the black box scene; through the perturbation optimization model and the boundary approximation model, iteratively update to obtain the target perturbation in the corresponding scene; the target perturbation can pass the detection of the target watermark detector and has the least interference to the original image; according to the target perturbation, generate the target adversarial sample. Through this embodiment, the target perturbation that can pass the detection of the target watermark detector and has the least interference to the original image can be obtained through the corresponding models in different scenes, thereby realizing the generation of effective and concealed target adversarial samples for different scenes.

[0038] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0040] Figure 1 is a hardware structure block diagram of a terminal of a method for generating digital watermark adversarial samples in an embodiment;

[0041] Figure 2 is a flow chart of a method for generating a digital watermark adversarial sample in an embodiment;

[0042] Figure 3 is a flow chart of a method for generating digital watermark adversarial samples in another embodiment;

[0043] Figure 4 The structure block diagram of a digital watermark adversarial sample generating device in an embodiment.

[0044] In the figure: 102, processor; 104, memory; 106, transmission device; 108, input and output device; 10, acquisition module; 20, model building module; 30, sample generation module. DETAILED DESCRIPTION

[0045] In order to more clearly understand the purpose, technical solutions and advantages of the present application, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0046] Unless otherwise defined, the technical terms or scientific terms involved in this application shall have the general meaning understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the", "these" and the like in this application do not represent quantitative restrictions, and they can be singular or plural. The terms "include", "comprise", "have" and any variants thereof involved in this application are intended to cover non-exclusive inclusions; for example, a process, method and system, product or device comprising a series of steps or modules (units) is not limited to the listed steps or modules (units), but may include unlisted steps or modules (units), or may include other steps or modules (units) inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether directly or indirectly. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships. For example, "A and / or B" can mean: A exists alone, A and B exist at the same time, and B exists alone. Usually, the character " / " indicates that the objects associated with each other are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0047] The method embodiment provided in this embodiment can be executed in a terminal, a computer or a similar computing device. For example, running on a terminal, Figure 1 FIG. 1 is a hardware structure diagram of a terminal of the digital watermark adversarial sample generation method of this embodiment. Figure 1 As shown, the terminal may include one or more ( Figure 1 Only one is shown in the figure) processor 102 and memory 104 for storing data, wherein processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA. The above terminal may also include a transmission device 106 and an input and output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0048] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the digital watermark adversarial sample generation method in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0049] The transmission device 106 is used to receive or send data via a network. The above network includes a wireless network provided by the communication provider of the terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.

[0050] With the rapid development of generative artificial intelligence technology, models such as DALL-E, Stable Diffusion, and Midjourney are able to create highly realistic image content. These technologies have shown great potential in improving work efficiency and creativity. However, these technologies have also brought new problems, such as the spread of false information on social media and digital fraud, which pose a serious threat to personal privacy and network security.

[0051] Digital watermarking technology is a method of embedding specific information in digital content (such as multimedia, documents, software, etc.). This information is usually invisible or difficult to detect, but can be detected by specific systems or algorithms. Therefore, it can be used in copyright protection, anti-counterfeiting and traceability, and security issues brought about by generative artificial intelligence.

[0052] In order to improve the security and robustness of digital watermarks, for different scenarios, security verification can be performed through simulated attacks, and the performance of watermark detectors can be evaluated. The current adversarial samples cannot meet these requirements, so it is necessary to generate an effective adversarial sample.

[0053] In this embodiment, a method for generating a digital watermark adversarial sample is provided. Figure 2 is a flow chart of the method for generating digital watermark adversarial samples in this embodiment. Figure 2 As shown, the method comprises the following steps:

[0054] Step S210, obtaining an original image.

[0055] Specifically, the original image serves as the input of the model in different scenarios, and it contains the original watermark. By identifying the original watermark, it is possible to identify personal privacy, copyright ownership, etc. in the original image, as well as to identify content generated by artificial intelligence.

[0056] Step S220, based on the original image and the target watermark detectors in different scenarios, respectively construct a perturbation optimization model in a white-box scenario and a boundary approximation model in a black-box scenario.

[0057] Specifically, corresponding models are constructed for different scenarios to generate more comprehensive target adversarial samples, which are not only applicable to white-box scenarios, but also to more universal black-box scenarios. In white-box scenarios, detailed internal information of the digital watermark carrier (such as image, audio or video) can be directly obtained, including the watermark embedding algorithm, key, original format of carrier data, etc. In black-box scenarios, the internal structure and parameters of the target system cannot be directly accessed, and the target system can only be interacted with through external interfaces (such as APIs), but the internal implementation details of the system cannot be obtained.

[0058] The perturbation optimization model and the boundary approximation model are designed to find a tiny target perturbation so that the perturbed original image can escape all target watermark detectors.

[0059] The threshold of the target watermark detector in the white-box scenario must be greater than the preset threshold, that is, the perturbation optimization model is applicable to any target watermark detector with a threshold greater than the preset threshold. For example, the preset threshold is 0.5. In the black-box scenario, the target watermark detector with a specific threshold is designed, and the boundary approximation model is trained for each target watermark detector.

[0060] Step S230, through the perturbation optimization model and the boundary approximation model, iteratively update to obtain the target perturbation in the corresponding scene; the target perturbation can pass the detection of the target watermark detector and has the least interference to the original image.

[0061] Specifically, the perturbation optimization model is used to iteratively update the target perturbation in the white-box scenario. The perturbation optimization model introduces the optimization problem from the image level, inputs the original image and the decoder into the model, and takes the first threshold of the first target watermark detector in the white-box scenario as the constraint of the optimization problem, and iteratively updates the target perturbation.

[0062] Through the boundary approximation model, the target perturbation in the black box scenario is obtained through iterative updates. Among them, the boundary approximation model is to design a second target watermark detector with an integrated classification layer structure from the watermark detector level, input the original image and the query interface of the second target watermark detector into the model, and continuously approach the decision boundary of the second target watermark detector during the iterative update process, that is, through iterative updates of the perturbation, it can pass the detection of the second target watermark detector, and the second target watermark detector is used to supervise the update of the perturbation.

[0063] The target perturbation can be detected by the target watermark detector, and the interference to the original image is minimal after being added to the original image. It is efficient and concealed.

[0064] Step S240, generating a target adversarial sample according to the target perturbation.

[0065] Specifically, the target adversarial samples of digital watermarks are generated according to the target perturbations. The target adversarial samples can be used to simulate various possible attack scenarios, help discover potential loopholes and weaknesses in the digital watermark system, and improve robustness and security.

[0066] Through the above steps, a perturbation optimization model for the white-box scenario and a boundary approximation model for the black-box scenario are constructed respectively, so as to obtain the target perturbation in the corresponding scenario through the two models respectively, and generate a target adversarial sample. The target perturbation can ensure a higher detection pass rate of the target watermark detector and smaller image interference, and is efficient and concealed. It also ensures the comprehensiveness and universality of the adversarial sample, taking into account both the original image of the standard training and the original image of the adversarial training, and is also applicable even if the original image has undergone adversarial training.

[0067] In some of the embodiments, in the above step S220, a disturbance optimization model in a white box scenario is constructed according to the original image and the target watermark detector in different scenarios, including the following steps:

[0068] Step S221, obtaining an image to be processed; the image to be processed is an original image that has undergone a first initial disturbance.

[0069] Step S222, in the disturbance optimization model, minimizing disturbance is taken as the optimization goal, and the bit-by-bit accuracy between the decoded image to be processed and the original watermark in the original image, and the first threshold of the first target watermark detector constitute constraints.

[0070] Specifically, the perturbation optimization model is designed to find a tiny target perturbation so that the original image after perturbation can escape the target watermark detector. The perturbation optimization model is applicable to any first target watermark detector whose threshold is greater than a preset threshold.

[0071] The optimization problem is introduced from the image level, and the goal is to find a small perturbation δ, so that the bit-by-bit accuracy of the watermark decoded from the original image after the perturbation and the original watermark w in the original image is close to the preset threshold, so that it can pass the detection of all first target watermark detectors. Specifically, the perturbation search task is defined as the following optimization problem, where minimizing the perturbation is the optimization goal, the image to be processed is obtained, and the bit-by-bit accuracy between the decoded image to be processed and the original watermark in the original image, as well as the first threshold of the first target watermark detector constitute constraints, and the following perturbation optimization model is obtained:

[0072]

[0073] st|R(D(I w +δ),w)-E|≤∈

[0074] Where δ represents disturbance; w represents the original watermark; E represents the preset threshold; I w Represents the original image; (I w +δ) represents the image to be processed; D represents the decoder; R(D(I w +δ),w) represents the bit-by-bit accuracy between the decoded image to be processed and the original watermark; ∈ is a small value; ‖‖ ∞ Represents the infinite norm. The constraint condition is called bit-by-bit accuracy constraint, which specifically compares the original watermark in string form with the decoded watermark bit by bit.

[0075] For the above optimization problems, there are still the following problems:

[0076] On the one hand, the real watermark w cannot be obtained, so the real watermark w in the optimization problem is replaced by the decoded original image D(I w ). However, if the decoded watermark D(I w ) is far from the original watermark w, even if we can find a perturbation δ that makes |R(D(I w +δ),D(I w ))-E|≤∈, and it cannot ensure that the bit-accuracy constraint is met. Therefore, since the original watermark is unknown, the original watermark w is replaced by a randomly selected target watermark w t , and reconstruct the optimization problem so that when the watermark D((I w +δ) is very close to the target watermark w t When , the bitwise accuracy constraint can be met with a high probability. Among them, the above random selection can avoid the accidental influence of the experiment. Specifically, the target watermark can be randomly generated repeatedly (for example, three times) and the target watermark with the best effect can be selected.

[0077] On the other hand, the bit-accuracy constraint is highly nonlinear, which complicates standard optimization techniques. To this end, the optimization problem is redesigned to make it easier to determine the gradient direction of the perturbation δ. After reconstructing the above perturbation optimization model, the following perturbation optimization model is obtained:

[0078]

[0079] st‖δ‖ ∞ ≤r

[0080] R(D(I w +δ),w t )≥1-∈

[0081] Among them, l represents the loss function; r represents the upper limit of perturbation; w t represents the target watermark; δ represents the disturbance; I w Represents the original image; (I w +δ) represents the image to be processed; D represents the decoder; R(D(I w +δ),w t ) represents the bit-by-bit accuracy between the decoded image to be processed and the target watermark; ∈ is a small value; ‖‖ ∞ Represents the infinite norm.

[0082] In this embodiment, by constructing a disturbance optimization model in a white-box scenario, it is possible to find the target disturbance under constraints by solving the above-mentioned optimization problem, so as to improve the robustness and concealment of the target disturbance.

[0083] In some embodiments, the above step S230 uses the disturbance optimization model to iteratively update the target disturbance in the corresponding scenario, including the following steps:

[0084] Step S231, by adaptively optimizing the disturbance boundary, iteratively updating on the basis of the first initial disturbance until the current disturbance meets the first preset condition or the number of iterations reaches an upper limit, thereby obtaining a first target disturbance.

[0085] Specifically, in the perturbation optimization model, a first initial perturbation is applied to the original image to obtain the image to be processed. In the iterative update process, the first initial perturbation is iteratively updated, and the target perturbation is found by adaptively optimizing the perturbation boundary until the current perturbation satisfies the first preset condition or the number of iterations reaches the upper limit, thereby obtaining the first target perturbation. The first preset condition may be a constraint condition in the perturbation optimization model, for example, the perturbation reaches the upper limit, or the bit-by-bit accuracy meets the accuracy requirement.

[0086] Among them, binary search is used in the adaptive optimization disturbance boundary to dynamically adjust the disturbance boundary as follows:

[0087] 1. Set the search interval [ra, rb] of the perturbation boundary, with the initial value ra = 0 and rb being a larger value (for example, rb = 2).

[0088] 2. Take the median R = (ra + rb) / 2, and perform disturbance optimization on the median R.

[0089] 3. Determine whether the current perturbation of the iterative update satisfies the constraints in the optimization problem (such as perturbation norm or bit accuracy requirements). If so, reduce the upper bound rb, otherwise reduce the lower bound ra.

[0090] 4. Continue to iterate the process until the search interval meets the set accuracy requirement (for example, rb-ra≤0.001).

[0091] Furthermore, the iterative update process also includes the following steps:

[0092] By performing a projection operation on the current disturbance, the norm of the current disturbance is made within the disturbance boundary; and / or, the momentum accumulator is updated according to the current gradient to update the current disturbance through the momentum accumulator; and / or, the current disturbance is updated according to the direction of the current gradient.

[0093] Specifically, within the above adaptive disturbance boundary R, ​​the following adaptive disturbance search is performed to improve the disturbance search efficiency:

[0094] 1. Initialize the perturbation δ=0.

[0095] 2. At each iteration, first calculate the loss function l(D(I w +δ),w t ) with respect to the gradient of the perturbation δ, and update δ with the learning rate α (initial step size) in the opposite direction of the gradient.

[0096] 3. After each gradient update, if the infinite norm of the current perturbation δ exceeds the perturbation boundary R, ​​a projection operation is performed on it to ensure that its norm remains within the perturbation boundary R to maximize the visual quality and concealment of the original image.

[0097] 4. The iteration is terminated until the maximum number of iterations max_iter is reached or the current perturbation δ satisfies the constraint condition (for example, bit accuracy or perturbation upper limit) in advance.

[0098] Since the traditional gradient descent method is prone to falling into the local optimal solution or slow convergence. In this embodiment, the momentum factor is introduced to accumulate the previous gradient momentum, reduce the oscillation of the path, significantly accelerate the convergence speed, and effectively improve the accessibility of the global optimal solution. The momentum accumulator is updated according to the current gradient to update the current disturbance through the momentum accumulator. Through the accumulation effect of momentum, the parameter update is more stable, which effectively accelerates the convergence process.

[0099] 1. Initialize the momentum accumulator m to zero.

[0100] 2. In each iteration, calculate the current gradient g and update the momentum accumulator using the momentum factor β:

[0101]

[0102] 3. Update the perturbation δ using the updated momentum accumulator m and learning rate α:

[0103]

[0104] In order to reduce the computational complexity, the current perturbation is updated according to the direction of the current gradient, which reduces the floating-point operation burden in the gradient calculation while maintaining accurate control of the perturbation direction, ensuring efficient perturbation generation capabilities in complex high-dimensional image data and showing strong robustness.

[0105] 1. In each iteration, calculate the sign (direction) of the current gradient g:

[0106] sign(g)←sgn(g)

[0107] 2. Use the signed gradient to update the perturbation δ, retaining only the direction information and ignoring the size information:

[0108] δ←δ-α·sign(g).

[0109] In addition, disturbance control and visual protection are performed during the iterative update process. The size of the disturbance is strictly limited through dynamic adjustment of the disturbance limit and projection operation so that it will not destroy the visual quality of the original image, thereby ensuring concealment.

[0110] 1. After each iteration, calculate the infinite norm of the current perturbation δ:

[0111] ‖δ‖ ∞ ←max(|δ|)

[0112] 2. If the norm of the disturbance exceeds the set boundary R, ​​project δ back to the range of the norm R:

[0113] δ←δ·r / ‖δ‖ ∞ .

[0114] Dynamic learning rate adjustment is performed during the iterative update process. To further improve training efficiency, this embodiment introduces an adaptive learning rate strategy to dynamically adjust the learning rate according to the change of gradient during the iteration process. This strategy ensures a larger step size update in the early stage of convergence to accelerate convergence; when the gradient slows down, the learning rate is reduced to prevent over-update or miss the local optimal solution, thereby ensuring that the parameters can be updated with the optimal step size at different optimization stages, thereby improving the convergence speed.

[0115] 1. Initially set the learning rate α.

[0116] 2. After each iteration, dynamically adjust the learning rate according to the current number of iterations k:

[0117] α←α / (1+γk).

[0118] Batch normalization is performed during the iterative update process to improve stability. In high-dimensional data processing, traditional optimization algorithms often face the problem of gradient vanishing or exploding. This study uses batch normalization technology to standardize the data of each batch, avoiding the instability of the gradient, making the training process more stable, and improving the overall convergence speed. The normalized data is used for subsequent gradient calculations to improve the stability and convergence speed of the algorithm.

[0119] 1. Before each iteration, the data X of the current batch is standardized and the mean μX and standard deviation σX are calculated:

[0120] μX←mean(X)

[0121] σX←std(X)

[0122] 2. Normalize the data using mean and standard deviation:

[0123] X ′ ←(X-μX) / (σX+∈).

[0124] In this embodiment, by designing an adaptive adjustment of the disturbance boundary and a dynamic optimization strategy during the iterative update process, it is possible to more efficiently explore the target disturbance and maintain strict control over the image quality, thereby obtaining efficient and concealed target disturbance.

[0125] In some of the embodiments, in the above step S220, based on the original image and the target watermark detector in different scenes, a boundary approximation model in a black box scene is constructed, including the following steps:

[0126] Step S223, obtaining a second target watermark detector by training the classification layer structure; the second target watermark detector is used to output a classification result of whether the current disturbance passes the detection.

[0127] Step S224, in the boundary approximation model, continuously iterate and approximate the decision boundary of the classification layer.

[0128] Specifically, the boundary approximation model is designed to find a tiny target perturbation so that the perturbed original image can escape the second target watermark detector with a specific threshold, and the boundary approximation model is trained for each second target watermark detector.

[0129] In the boundary approximation model, from the watermark detector level, a second target watermark detector integrated with a classification layer structure is designed. The original image and the query interface of the second target watermark detector are input into the model, and the decision boundary of the second target watermark detector is continuously approached during the iterative update process. That is, the perturbation is iteratively updated so that it can pass the detection of the second target watermark detector. The second target watermark detector can output the classification result of whether the current perturbation passes the detection, and the classification result is used to supervise the update of the perturbation.

[0130] The design of the classification layer structure supports single-tailed and double-tailed detection, which is used to process the detection task of the presence or absence of watermarks in the input image. The input original image is extracted by the decoder to obtain the watermark information decoded_messages, whose shape is (batch_size, watermark_length), and the bit accuracy is calculated with the expected watermark information message. The decoded watermark information is rounded and its value is limited to the range of [0,1]. In the double-tailed detection mode, the classification layer compares whether the bit accuracy exceeds the set threshold th (that is, the bit accuracy is greater than th or less than 1-th); in the single-tailed detection mode, it only determines whether the bit accuracy exceeds the threshold th. The classification result class_idx is generated according to the above comparison result. The result is one-hot encoded with a shape of (batch_size, 2), where the first dimension indicates that the detection failed and the second dimension indicates that the detection passed successfully.

[0131] The classification layer is integrated into the second target watermark detector and forms a sequential network with the watermark decoder. The network evaluates in real time whether the adversarial sample successfully circumvents the second target watermark detector. During each perturbation update and optimization process, the watermark information of the input image is extracted through the watermark decoder, the bit accuracy is calculated with the expected watermark information message, and the classification result class_idx is output by the classification layer. If the bit accuracy meets the threshold th, the perturbation is considered to have successfully passed the detection. The classification result is used to guide the subsequent perturbation generation and optimization strategy to ensure that the adversarial sample achieves the expected attack effect.

[0132] In this embodiment, by constructing a boundary approximation model in a black box scenario, a second target watermark detector with a specific threshold is designed, a model is trained for each watermark detector, and the decision boundary is continuously approached in the process of iteratively updating the disturbance to determine the target disturbance.

[0133] In some of the embodiments, it also includes:

[0134] The original image is subjected to adaptive median filtering and compression initialization in advance, and a second initial disturbance that can be detected by a second target watermark detector is determined.

[0135] Specifically, in order to reduce the random noise in the original image, the input original image is first subjected to the following adaptive median filtering:

[0136] 1. Set the maximum kernel size of the filter to max_kernel_size, for example, 5 or 7.

[0137] 2. For each pixel of the original image, select the initial kernel size k=3 and extract the local sub-image S(i,j,k).

[0138] 3. Calculate the median(S(i,j,k)), minimum min(S(i,j,k)) and maximum max(S(i,j,k)) of the sub-image.

[0139] 4. If the median (S (i, j, k)) is between the minimum value min (S (i, j, k)) and the maximum value max (S (i, j, k)), the median is considered valid and the current pixel value Z is further checked. xy Is it within this range: If it is within the range, keep the original pixel value Z xy ; If it is not within the range, replace the original pixel value with the median(S(i,j,k)).

[0140] 5. If the kernel size k reaches the maximum value max_kernel_size and the median is still invalid, replace the pixel value with the currently calculated median.

[0141] After adaptive median filtering, the image is compressed with JPEG at different quality factors as follows:

[0142] 1. Normalize the filtered image to the range [0,1] to ensure the consistency of the JPEG compression process.

[0143] 2. Apply a series of JPEG compression quality factors (for example, a quality factor list [99, 95, 90, 85, 80]) to the standardized image to generate images Xjpeg with different compression qualities.

[0144] 3. For each compressed image Xjpeg, rescale it back to the original pixel value range and detect its circumvention effect through the watermark detector model: if the detector fails to detect the watermark, record this image as the initial adversarial sample Xadv; if adversarial samples that circumvent the detector are not successfully generated in all quality factors, continue to try lower quality factors or perform further optimization.

[0145] 4. Output the generated initial adversarial sample Xadv and the corresponding query count record as the basis for subsequent iterative updates.

[0146] Therefore, the initial adversarial sample Xadv can pass the detection of the second target watermark detector. The second initial perturbation can be determined based on the initial adversarial sample Xadv. Compared with using random samples as the basis for iterative updating, the second initial perturbation in this embodiment is closer to the second target perturbation.

[0147] In some of the embodiments, the target disturbance in the corresponding scenario is obtained by iteratively updating the boundary approximation model, including the following steps:

[0148] According to the classification result, the current disturbance is dynamically adjusted on the basis of the second initial disturbance until the current disturbance meets the second preset condition or the number of iterations reaches an upper limit, thereby obtaining a second target disturbance.

[0149] Specifically, since in the boundary approximation model, the second target watermark detector can output a classification result of whether the current perturbation passes the detection, and the classification result is used to supervise the update of the perturbation, specifically, after each round of iteration, whether the original image (i.e., the adversarial sample) with the current perturbation added can pass the detection, therefore, in the process of iterative update, the above-mentioned initial adversarial sample can be used as the basis for iterative update for update. Accordingly, the current perturbation is dynamically adjusted on the basis of the second initial perturbation until the current perturbation meets the second preset condition or the number of iterations reaches the upper limit, and the second target perturbation is obtained, that is, the current perturbation is dynamically adjusted on the basis of the initial adversarial sample until the current perturbation meets the second preset condition or the number of iterations reaches the upper limit, and the target adversarial sample is finally generated. Among them, the second preset condition of the perturbation can be the optimization limit of the perturbation adjustment, etc.

[0150] Furthermore, in the iterative update process, it also includes:

[0151] Dynamically adjust the perturbation step size according to the decision boundary and the current disturbance; and / or, make the norm of the current disturbance within the perturbation boundary by performing a projection operation on the current disturbance; and / or, determine the perturbation boundary of the current disturbance by binary search; and / or, record the number of queries of the second target watermark detector, and terminate the iteration when the number of queries reaches an upper limit.

[0152] Specifically, dynamic query, disturbance adjustment, and evaluation optimization of disturbance effects are performed during the iterative update process:

[0153] The following is a dynamic query adjustment strategy, which records the query times of the second target watermark detector. When the query times reaches the upper limit, the iteration is terminated:

[0154] During the optimization process, the query operation on the second target watermark detector is managed in real time through the embedded query count tracking mechanism. Each time an adversarial sample is generated, the algorithm records the current query count query_count. When query_count approaches the preset query limit max_queries (for example, 500 times), the algorithm automatically stops further queries and returns the current optimal adversarial sample x_adv as the target adversarial sample. This mechanism ensures that adversarial samples are effectively generated within a limited number of queries to avoid wasting resources through the setting of the parameter max_queries.

[0155] The following is a dynamic perturbation adjustment, which dynamically adjusts the perturbation step size based on the decision boundary and the current perturbation:

[0156] 1. For each iteration, dynamically adjust the perturbation step size step_size according to the distance distance_to_boundary between the current adversarial sample x_adv and the decision boundary. Initially, step_size is set to a large value (such as 0.1) so that it can be adjusted quickly when it is far away from the decision boundary. When distance_to_boundary decreases and the sample gradually approaches the decision boundary, the algorithm will gradually reduce step_size according to the effect of the current perturbation, for example, halving it to step_size / 2, to ensure more precise adjustments when approaching the boundary.

[0157] 2. The perturbation adjustment uses the gradient descent method, and the initial learning rate learning_rate is set to a larger value (such as 0.05) to quickly adjust within a larger range. When step_size is reduced, learning_rate is also reduced accordingly to ensure that the fineness of the perturbation is maintained during the optimization process and the optimal adversarial samples are gradually generated.

[0158] The following is the evaluation and optimization of the perturbation effect:

[0159] After each round of dynamic adjustment, the distance distance_to_boundary between the current sample x_adv and the decision boundary is evaluated. When distance_to_boundary is less than the preset threshold epsilon (e.g. 0.001) or step_size is too small to be effective (e.g. less than 0.0001), the algorithm determines that the perturbation adjustment has reached the optimization limit, stops further optimization, and uses the current adversarial sample x_adv as the target adversarial sample for the final output.

[0160] The above dynamic query and perturbation adjustment mechanism enables the boundary approximation model to generate the optimal target adversarial sample within a limited number of queries, ensuring sample effectiveness and efficiency, by coordinating the parameter query limit max_queries, perturbation step size step_size, learning rate learning_rate, and threshold epsilon.

[0161] The following uses binary search and iterative optimization to perform binary search of perturbation boundaries, dynamic adjustment of iterative optimization, projection and normalization of perturbations, and generation of termination conditions and adversarial samples.

[0162] Among them, in the binary search of the perturbation boundary, the perturbation boundary of the current perturbation is determined by binary search:

[0163] 1. Binary search is used to accurately determine the minimum effective perturbation boundary of the adversarial sample. Initially, the perturbation boundary [ra, rb] is set, where ra is 0 and rb is 1.0. The algorithm performs a binary search within this interval, first calculating the middle value R = (ra + rb) / 2, and generates an adversarial sample x_adv with this perturbation radius.

[0164] 2. After the sample is generated, the second target watermark detector API is used to evaluate whether the adversarial sample x_adv can successfully pass the detector. If the sample successfully passes the detection, the upper bound rb = R is reduced, otherwise the lower bound ra = R is increased. This process continues, gradually reducing the perturbation range until the difference between rb and ra is less than the set precision threshold epsilon, ensuring that the minimum effective perturbation boundary is found.

[0165] The following is a dynamic adjustment of iterative optimization under perturbation bounds:

[0166] 1. After determining the initial perturbation boundary, the algorithm enters the iterative optimization phase to further reduce the perturbation and enhance the attack effect of the adversarial sample. In each iteration, the algorithm calculates the gradient of the current perturbation δ and updates the perturbation using back propagation. The update formula is as follows:

[0167]

[0168] Among them, α is the dynamically adjusted learning rate; It represents the gradient of the loss function l between the current adversarial sample xadv and the decision boundary y, that is, the gradient of the current perturbation δ.

[0169] 2. The learning rate δ is adjusted based on the distance between the sample and the decision boundary. When the distance is far, a larger step size epsilon is used to speed up the convergence speed; when approaching the decision boundary, epsilon is gradually reduced to make more refined adjustments, thereby optimizing the adversarial sample to achieve the best attack effect with minimal disturbance.

[0170] The following is the projection and normalization of the perturbation. By performing a projection operation on the current perturbation, the norm of the current perturbation is within the perturbation boundary:

[0171] 1. After each iterative perturbation update, the algorithm checks whether the infinite norm of the current perturbation exceeds the perturbation boundary R determined by binary search. If it exceeds the boundary, the algorithm projects the perturbation δ back into the allowed perturbation range. This projection operation ensures that the adversarial sample remains at the minimum perturbation while still evading the detector.

[0172] 2. In order to further normalize the perturbation δ, the algorithm recalculates the perturbation norm after each projection and performs necessary normalization operations to ensure that the perturbation is evenly distributed in all dimensions, thereby maintaining the visual quality and effect of the image.

[0173] The following are the termination conditions and the process of generating adversarial samples:

[0174] 1. Iterative optimization continues until one of the following termination conditions is met: the preset maximum number of iterations max_iter is reached or the perturbation δ has been minimized and is sufficient to successfully evade the detector. At the end of each iteration, the algorithm evaluates whether the current adversarial sample x_adv has achieved the expected attack effect. If so, the iteration is stopped early and the final adversarial sample is output.

[0175] After multiple binary searches and iterative optimizations in the above steps, the adversarial sample x_adv finally generated can not only effectively evade the detector but also has minimal disturbance, ensuring the optimal attack effect while maintaining image quality.

[0176] In addition, the following early stopping mechanism and exception handling are set up during the iterative update process:

[0177] In the following early stopping mechanism:

[0178] 1. In the process of generating adversarial samples, in order to improve efficiency and prevent over-computation, the algorithm introduces an early stopping mechanism. When it is detected that the perturbation of the adversarial sample has reached the preset standard, the early stopping mechanism will automatically terminate further optimization. Specifically, when the algorithm finds that it has successfully circumvented the second target watermark detector by evaluating the effect of the current perturbation δ and the perturbation has been minimized, the algorithm will immediately stop iterating and save the current optimal adversarial sample x_adv as the target adversarial sample.

[0179] 2. The key parameters of the early stopping mechanism include the preset maximum number of queries (max_queries) and the maximum number of iterations (max_iter). When the number of queries reaches max_queries or the number of iterations reaches max_iter, and the current adversarial sample meets the requirements, the algorithm will trigger the early stopping mechanism and end the adversarial sample generation process in advance.

[0180] In the following exception handling mechanism:

[0181] 1. To ensure the stability of the algorithm in complex environments, especially when dealing with large-scale data sets and dealing with unstable inputs, the algorithm integrates a comprehensive exception handling mechanism. In the process of generating adversarial samples, various abnormal situations may be encountered, such as gradient calculation errors, unstable predictions, or insufficient memory. In order to prevent these anomalies from causing algorithm interruptions, the exception handling mechanism will capture and safely handle these errors.

[0182] 2. When an anomaly is detected, the algorithm will perform the following operations: record the anomaly information in a log file for subsequent analysis and debugging; depending on the type of anomaly, the algorithm may try to reinitialize the perturbation of the current sample and continue the optimization process from the most recent successful state; if the anomaly cannot be recovered (such as insufficient memory causing the calculation to be unable to continue), the algorithm will safely exit the current task and return the saved optimal adversarial sample x_adv to ensure that the generated valid data will not be lost, thereby ensuring the robustness of the algorithm in operation and being able to cope with various emergencies.

[0183] The present embodiment is described and illustrated below through preferred embodiments.

[0184] Figure 3 is a flow chart of the method for generating digital watermark adversarial samples in this embodiment. Figure 3 As shown, the method comprises the following steps:

[0185] Step S310: in a white-box scenario, obtaining an original image, an image to be processed, and a first target watermark detector.

[0186] Step S320, taking minimizing disturbance as the optimization goal, taking the bit-by-bit accuracy between the decoded image to be processed and the original watermark in the original image, and the first threshold of the first target watermark detector as constraints, and constructing a disturbance optimization model.

[0187] Step S330, by adaptively optimizing the disturbance boundary, iteratively updating on the basis of the first initial disturbance until the current disturbance meets the first preset condition or the number of iterations reaches an upper limit, thereby obtaining a first target disturbance.

[0188] Step S340, in a black box scenario, obtaining an original image; and obtaining a second target watermark detector by training a classification layer structure.

[0189] Step S350: Perform adaptive median filtering and compression initialization on the original image in advance to determine a second initial disturbance that can be detected by a second target watermark detector.

[0190] Step S360, in the boundary approximation model, according to the classification result of the second target watermark detector, the current disturbance is dynamically adjusted on the basis of the second initial disturbance, and the decision boundary is continuously approached until the current disturbance meets the second preset condition or the number of iterations reaches the upper limit, thereby obtaining the second target disturbance.

[0191] Step S370: Determine target adversarial samples in white-box scenarios and black-box scenarios respectively according to the first target perturbation and the second target perturbation.

[0192] It should be noted that the steps shown in the above process or the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than here. For example, steps S310-S330 in the white box scenario and steps S340-S360 in the black box scenario are executed separately according to the needs of the scenario.

[0193] Through the above steps, the target perturbation in the corresponding scenario is obtained through the two models in the white-box scenario and the black-box scenario respectively, and the target adversarial sample is generated. The target perturbation can ensure a higher detection pass rate of the target watermark detector and smaller image interference, and has high efficiency and concealment. It also ensures the comprehensiveness and universality of the adversarial sample, taking into account the original image of the standard training and the original image of the adversarial training, and is also applicable even if the original image has undergone adversarial training.

[0194] In this embodiment, a device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. The terms "module", "unit", "subunit" and the like used below can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0195] Figure 4 is a structural block diagram of the digital watermark adversarial sample generation device of this embodiment. Figure 4 As shown, the device comprises:

[0196] The acquisition module 10 is used to acquire the original image.

[0197] The model building module 20 is used to build a perturbation optimization model in a white-box scenario and a boundary approximation model in a black-box scenario according to the original image and the target watermark detector in different scenarios.

[0198] The sample generation module 30 is used to iteratively update the target perturbation in the corresponding scene through the perturbation optimization model and the boundary approximation model; the target perturbation can pass the detection of the target watermark detector and has minimal interference to the original image; according to the target perturbation, a target adversarial sample is generated.

[0199] Through the device provided in this embodiment, a perturbation optimization model for a white-box scenario and a boundary approximation model for a black-box scenario are respectively constructed, so as to obtain the target perturbation in the corresponding scenario through the two models respectively, and generate a target adversarial sample. The target perturbation can ensure a higher detection pass rate of the target watermark detector and smaller image interference, and is efficient and concealed. It also ensures the comprehensiveness and universality of the adversarial sample, taking into account both the original image of the standard training and the original image of the adversarial training, and is also applicable even if the original image has undergone adversarial training.

[0200] In some of the embodiments, the model building module 20 is further configured to:

[0201] Acquire an image to be processed; the image to be processed is an original image that has undergone a first initial disturbance;

[0202] In the disturbance optimization model, minimizing disturbance is taken as the optimization goal, and the bit-by-bit accuracy between the decoded image to be processed and the original watermark in the original image and the first threshold of the first target watermark detector constitute constraints.

[0203] In some of the embodiments, in the model building module 20, the disturbance optimization model is:

[0204]

[0205] st|R(D(I w +δ),w)-E|≤∈

[0206] Where δ represents disturbance; w represents the original watermark; E represents the preset threshold; I w Represents the original image; (I w +δ) represents the image to be processed; D represents the decoder; R(D(I w +δ),w) represents the bit-by-bit accuracy between the decoded image to be processed and the original watermark; ∈ is a small value; ‖‖ ∞ Represents the infinite norm.

[0207] In some of the embodiments, the sample generation module 30 is further used to: optimize the disturbance boundary adaptively, iteratively update on the basis of the first initial disturbance, until the current disturbance meets the first preset condition or the number of iterations reaches an upper limit, to obtain the first target disturbance.

[0208] In some of the embodiments, the sample generation module 30 is further used to: during the iterative update process,

[0209] By performing a projection operation on the current disturbance, the norm of the current disturbance is made within the disturbance boundary;

[0210] and / or, updating a momentum accumulator according to a current gradient, so as to update a current disturbance through the momentum accumulator;

[0211] And / or, update the current perturbation according to the direction of the current gradient.

[0212] In some of the embodiments, the model building module 20 is further configured to:

[0213] By training the classification layer structure, a second target watermark detector is obtained; the second target watermark detector is used to output a classification result of whether the current disturbance passes the detection; in the boundary approximation model, the decision boundary of the classification layer is continuously iterated and approximated.

[0214] In some of the embodiments, the model building module 20 is further configured to:

[0215] The original image is subjected to adaptive median filtering and compression initialization in advance, and a second initial disturbance that can be detected by a second target watermark detector is determined.

[0216] In some of the embodiments, the sample generation module 30 is further configured to:

[0217] According to the classification result, the current disturbance is dynamically adjusted on the basis of the second initial disturbance until the current disturbance meets the second preset condition or the number of iterations reaches an upper limit, thereby obtaining a second target disturbance.

[0218] In some of the embodiments, the sample generation module 30 is further used to: during the iterative update process,

[0219] Dynamically adjust the perturbation step size based on the decision boundary and the current perturbation;

[0220] and / or, by performing a projection operation on the current disturbance, making the norm of the current disturbance within the disturbance boundary;

[0221] and / or, determining a perturbation boundary of the current perturbation by binary search;

[0222] And / or, record the query times of the second target watermark detector, and terminate the iteration when the query times reaches an upper limit.

[0223] It should be noted that the above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0224] In this embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0225] Optionally, the computer device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0226] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementation modes, and will not be repeated in this embodiment.

[0227] In addition, in combination with the method provided in the above embodiment, a storage medium may be provided in this embodiment to implement the method. The storage medium stores a computer program; when the computer program is executed by a processor, any one of the digital watermark adversarial sample generation methods in the above embodiment is implemented.

[0228] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0229] It should be understood that the specific embodiments described herein are only used to explain the application, rather than to limit it. Based on the embodiments provided in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the protection scope of this application.

[0230] Obviously, the drawings are only some examples or embodiments of the present application. For ordinary technicians in the field, the present application can also be applied to other similar situations based on these drawings without creative work. In addition, it is understandable that although the work done in this development process may be complicated and lengthy, for ordinary technicians in the field, certain changes in design, manufacturing or production based on the technical content disclosed in this application are only conventional technical means and should not be regarded as insufficient content disclosed in this application.

[0231] The term "embodiment" in this application refers to a specific feature, structure or characteristic described in conjunction with the embodiment that can be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily mean the same embodiment, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. It is clearly or implicitly understood by those of ordinary skill in the art that the embodiments described in this application can be combined with other embodiments without conflict.

[0232] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the attached claims.

Claims

1. A method for generating digital watermark adversarial samples, characterized in that: include: Get the original image; According to the original image and the target watermark detectors in different scenarios, a perturbation optimization model in a white box scenario and a boundary approximation model in a black box scenario are respectively constructed; By using the disturbance optimization model and the boundary approximation model, the target disturbance in the corresponding scene is obtained by iterative updating; the target disturbance can be detected by the target watermark detector and has minimal interference to the original image; According to the target perturbation, a target adversarial sample is generated.

2. The method for generating digital watermark adversarial samples according to claim 1, characterized in that: The method of constructing a disturbance optimization model in a white box scenario according to the original image and the target watermark detector in different scenarios includes: Acquire an image to be processed; the image to be processed is the original image after the first initial disturbance; In the disturbance optimization model, minimizing disturbance is taken as the optimization goal, and the bit-by-bit accuracy between the decoded image to be processed and the original watermark in the original image, and the first threshold of the first target watermark detector constitute constraints.

3. The method for generating digital watermark adversarial samples according to claim 2, characterized in that: The disturbance optimization model is: s.t.|R(D(I w +δ),w)-E|≤∈ Where δ represents disturbance; w represents the original watermark; E represents the preset threshold; I w Represents the original image; (I w +δ) represents the image to be processed; D represents the decoder; R(D(I w +δ),w) represents the bit-by-bit accuracy between the decoded image to be processed and the original watermark; ∈ is a small value; ‖‖ ∞ Represents the infinite norm.

4. The method for generating digital watermark adversarial samples according to claim 2, characterized in that: The target disturbance in the corresponding scenario is obtained by iteratively updating the disturbance optimization model, including: By adaptively optimizing the disturbance boundary, iteratively updating based on the first initial disturbance until the current disturbance meets the first preset condition or the number of iterations reaches an upper limit, a first target disturbance is obtained.

5. The method for generating digital watermark adversarial samples according to claim 4, characterized in that: The iterative update process also includes: By performing a projection operation on the current disturbance, a norm of the current disturbance is made within the disturbance boundary; and / or, updating a momentum accumulator according to a current gradient, so as to update the current disturbance via the momentum accumulator; And / or, updating the current disturbance according to the direction of the current gradient.

6. The method for generating digital watermark adversarial samples according to claim 1, characterized in that: The step of constructing a boundary approximation model in a black box scenario according to the original image and the target watermark detector in different scenarios includes: By training the classification layer structure, a second target watermark detector is obtained; the second target watermark detector is used to output a classification result of whether the current disturbance passes the detection; In the boundary approximation model, the decision boundary of the classification layer is approximated continuously and iteratively.

7. The method for generating digital watermark adversarial samples according to claim 6, characterized in that: Also includes: The original image is subjected to adaptive median filtering and compression initialization in advance to determine a second initial disturbance that can be detected by the second target watermark detector.

8. The method for generating digital watermark adversarial samples according to claim 7, characterized in that: The target disturbance in the corresponding scenario is obtained by iteratively updating the boundary approximation model, including: According to the classification result, the current disturbance is dynamically adjusted on the basis of the second initial disturbance until the current disturbance meets a second preset condition or the number of iterations reaches an upper limit, thereby obtaining a second target disturbance.

9. The method for generating digital watermark adversarial samples according to claim 8, characterized in that: The iterative update process also includes: Dynamically adjusting the perturbation step size according to the decision boundary and the current perturbation; and / or, performing a projection operation on the current disturbance so that the norm of the current disturbance is within the disturbance boundary; and / or, determining a disturbance boundary of the current disturbance by binary search; And / or, recording the query times of the second target watermark detector, and terminating the iteration when the query times reaches an upper limit.

10. A computer device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to execute the method for generating a digital watermark adversarial sample according to any one of claims 1 to 9.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for generating digital watermark adversarial samples according to any one of claims 1 to 9 are implemented.

Images